# M2 DEV Deployment Smoke Dry-Run

`m2-dev-deploy-smoke` is a local dry-run smoke harness for the HWLAB DEV
deployment shape. It validates the frozen route phases, service identities,
artifact metadata, and safety gates without contacting the real DEV ingress by
default.

Run the dry-run from the repository root:

```sh
node scripts/m2-dev-deploy-smoke.mjs --dry-run
```

## What It Checks

- Parses `fixtures/dev-deploy-smoke/dev-deploy-smoke.json`.
- Verifies the route phases in order:
  `master-edge-proxy`, `frp-tunnel`, `d601-router`, `cloud-surface`,
  `agent-runtime`, and `sim-and-patch-panel`.
- Validates the frozen HWLAB service IDs for master edge proxy, frp tunnel,
  D601 `hwlab-dev/hwlab-router`, cloud-api/web, agent, sim, and patch-panel.
- Checks `commitId`, `image`, `digest` or `not_applicable`, `tag`,
  `buildSource`, `deployEnv`, `healthTimestamp`, and failure classification
  for every recorded service contract.
- Confirms the cloud surface bundles `hwlab-cloud-api` and `hwlab-cloud-web`
  artifacts together under the same route phase.
- Marks the fixture as dry-run evidence only. Any DB fields in fixture health
  records are contract placeholders, not live DB evidence.
- Keeps the default mode in dry-run and refuses real requests unless an
  explicit live gate is supplied.

## Live Gate

The live gate is intentionally strict. It is only for a future real DEV smoke
observation, not for deployment, and this harness stays fixture-only by
default.

Required flags:

```sh
node scripts/m2-dev-deploy-smoke.mjs --live --confirm-dev --confirmed-non-production
```

Before using `--live`, confirm all of the following:

- the target remains `http://74.48.78.17:16667`;
- the workspace is not a PROD or shared deployment context;
- no prohibited action is being attempted;
- the request is observational only and does not mutate runtime state.

The script rejects live execution if any of these are missing:

- `--confirm-dev`
- `--confirmed-non-production`
- `--prod`
- `--heavyweight-e2e`
- `--read-secret`
- `--force-push`

## Boundary

This harness does not:

- deploy to DEV or PROD;
- call the real DEV endpoint in dry-run mode;
- run heavy e2e coverage;
- read secrets or tokens;
- replace HWLAB runtime services with UniDesk substitutes;
- touch L5 deploy manifests.

The fixture is a dry-run record only. It exists to prove that the M2 smoke
entry point understands the frozen route and artifact contract before any live
DEV observation is attempted.